Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

Cheval de Troie: Hijacker.gen [Résolu]

Guenillot
 Partager

Messages recommandés

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bon signe.

 

Poste le nouveau log Hijackthis stp.

 

@++

Guenillot Junior Member

Guenillot

Posté(e)
  • Auteur
Posté(e)

Alors là, truc de fou. Antivir me trouve un autre virus:

 

Dans le fichier 'C:\WINDOWS\system32\drivers\hjbpbrjo.sys'

un virus ou un programme indésirable 'TR/Patched.Gen' [trojan] a été détecté.

Action exécutée : Supprimer le fichier

 

 

 

Sinon, Hijackthis donne çà:

 

Logfile of random's system information tool 1.06 (written by random/random)

Run by Fanou at 2010-05-23 20:33:19

Microsoft Windows XP Édition familiale Service Pack 3

System drive C: has 18 GB (24%) free of 76 GB

Total RAM: 1022 MB (23% free)

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:34:03, on 23/05/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\Program Files\ASUS\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

C:\Program Files\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\QuickTime\QTTask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\HPQ\SHARED\HPQWMI.exe

C:\Program Files\Java\jre6\bin\jucheck.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Fanou\Bureau\Antivirus\RSIT.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Documents and Settings\Fanou\Bureau\Antivirus\Fanou.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/ServicesAcces.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {E68E2B73-8EA0-4A94-A901-EB2C55A23932} - c:\windows\system32\udjsklr.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [synTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [iSUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')

O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\ASUS\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm

O8 - Extra context menu item: Envoyer à Bluetooth - C:\Program Files\ASUS\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ASUS\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ASUS\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - http://copainsdavant.linternaute.com/frame...geUploader5.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase6662.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1170017079718

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/maconfi...fig_3_5_3_0.cab

O16 - DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} (FTMediaPlayer Class) - http://webtv.guidetv.orange.fr/resources/OCS_9418.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ASUS\Bluetooth Software\bin\btwdins.exe

O23 - Service: Service Google Update (gupdate1c9a8b8bcc51050) (gupdate1c9a8b8bcc51050) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe

O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

--

End of file - 11048 bytes

 

======Scheduled tasks folder======

 

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1143979466.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2826103261-839955967-4107118250-1006.job

C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2826103261-839955967-4107118250-1006.job

C:\WINDOWS\tasks\Symantec NetDetect.job

C:\WINDOWS\tasks\User_Feed_Synchronization-{D3C75F43-DEEB-45DD-9930-304B2E5B4289}.job

 

======Registry dump======

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]

RealPlayer Download and Record Plugin for Internet Explorer - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-03-12 329312]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - c:\program files\google\googletoolbar3.dll [2007-01-20 2436160]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-12-05 764912]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E68E2B73-8EA0-4A94-A901-EB2C55A23932}]

c:\windows\system32\udjsklr.dll [2004-08-05 114176]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar3.dll [2007-01-20 2436160]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2008-07-09 919016]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]

"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2005-06-19 729178]

"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]

"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

"ISUSScheduler"=C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe [2004-07-27 81920]

"ISUSPM Startup"=c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe [2004-07-27 221184]

"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576]

"eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [2005-10-11 409600]

"Cpqset"=C:\Program Files\HPQ\Default Settings\cpqset.exe [2005-08-01 233534]

"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-09-27 344064]

"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]

"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2010-03-12 202256]

"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe /CHECKNOW []

"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-09-18 68856]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gotnewupdate000.exe]

C:\Documents and Settings\Fanou\Application Data\110A0F8412C1B9A25D0DEEF69C4385FD\gotnewupdate000.exe []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hdqgyykv]

C:\Documents and Settings\Fanou\Local Settings\Application Data\gbflwonim\iiycwjgtssd.exe []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]

C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [2005-05-04 794624]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hsfe8owijfisjhgs7ye39gjsoighsd7y3eu]

C:\DOCUME~1\Fanou\LOCALS~1\Temp\i1llwh9.exe []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hsfg9w8gujsokgahi8gysgnsdgefshyjy]

C:\DOCUME~1\Fanou\LOCALS~1\Temp\lsass.exe []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

C:\Program Files\Ahead\InCD\InCD.exe [2004-09-07 1450094]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

C:\Program Files\iTunes\iTunesHelper.exe [2004-10-13 278528]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]

c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe [2004-10-14 253952]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M5T8QL3YW3]

C:\DOCUME~1\Fanou\LOCALS~1\Temp\Jvd.exe []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcexecwin]

C:\DOCUME~1\Fanou\LOCALS~1\Temp\owwztd.dll, RestoreWindows []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

C:\Program Files\QuickTime\qttask.exe [2010-03-17 421888]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]

C:\PROGRA~1\SPYWAR~2\SpywareTerminatorShield.exe [2008-11-09 2158592]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2010-03-12 202256]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]

C:\PROGRA~1\ASUS\BLUETO~1\BTTray.exe [2008-04-14 596584]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]

C:\PROGRA~1\Hp\DIGITA~1\bin\hpqtra08.exe [2004-11-04 258048]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hp psc 1000 series.lnk]

C:\PROGRA~1\HP\DIGITA~1\bin\hpohmr08.exe [2003-04-06 147456]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]

C:\PROGRA~1\HP\DIGITA~1\bin\hpotdd01.exe [2003-04-06 28672]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk]

C:\PROGRA~1\SAGEMW~1.11G\WLANUTL.exe []

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Fanou^Menu Démarrer^Programmes^Démarrage^Antimalware Doctor.lnk]

C:\Documents and Settings\Fanou\Application Data\110A0F8412C1B9A25D0DEEF69C4385FD\gotnewupdate000.exe []

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

C:\WINDOWS\system32\Ati2evxx.dll [2005-09-28 46080]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]

avgrsstx.dll []

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WINDOW~4\MpShHook.dll [2006-11-03 83224]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro35]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro35.sys]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=95000000

"NoFolderOptions"=0

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"

"C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe"="C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 Complete"

"C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe"="C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4: Warlords"

"C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe"="C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:*:Enabled:Sid Meier's Civilization 4: Beyond the Sword"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee5baf8e-ba11-11dc-b03a-0014a56d8490}]

shell\AutoRun\command - F:\LaunchU3.exe -a

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f08334b5-ae7b-11de-8ac1-0014a56d8490}]

shell\AutoRun\command - F:\WDSetup.exe

 

 

======List of files/folders created in the last 1 months======

 

2010-05-23 18:22:48 ----A---- C:\TDSSKiller.2.3.0.0_23.05.2010_18.22.48_log.txt

2010-05-23 18:22:11 ----A---- C:\TDSSKiller.2.3.0.0_23.05.2010_18.22.11_log.txt

2010-05-23 17:33:22 ----A---- C:\Ad-Report-CLEAN[1].txt

2010-05-23 17:19:50 ----A---- C:\Ad-Report-SCAN[1].txt

2010-05-23 17:19:43 ----D---- C:\Ad-Remover

2010-05-23 07:48:44 ----A---- C:\TDSSKiller.2.3.0.0_23.05.2010_07.48.44_log.txt

2010-05-23 07:47:24 ----A---- C:\TCleaner.txt

2010-05-22 22:52:30 ----D---- C:\Documents and Settings\Fanou\Application Data\QuickScan

2010-05-22 18:31:42 ----D---- C:\WINDOWS\ERDNT

2010-05-22 18:29:47 ----D---- C:\Qoobox

2010-05-22 17:09:58 ----D---- C:\Program Files\Mozilla Firefox

2010-05-22 15:31:48 ----SHD---- C:\found.000

2010-05-22 15:16:10 ----D---- C:\Documents and Settings\Fanou\Application Data\Mozilla

2010-05-22 14:51:58 ----D---- C:\Program Files\QuickTime

2010-05-22 14:50:54 ----D---- C:\Program Files\Fichiers communs\Apple

2010-05-22 14:50:31 ----D---- C:\Program Files\Apple Software Update

2010-05-22 14:50:31 ----D---- C:\Documents and Settings\All Users\Application Data\Apple

2010-05-22 14:47:07 ----D---- C:\Documents and Settings\Fanou\Application Data\DivX

2010-05-22 14:45:47 ----D---- C:\Program Files\Fichiers communs\DivX Shared

2010-05-22 14:43:32 ----D---- C:\Documents and Settings\All Users\Application Data\DivX

2010-05-21 12:22:15 ----D---- C:\tdsskiller

2010-05-21 08:53:51 ----DC---- C:\WINDOWS\system32\DRVSTORE

2010-05-21 08:38:42 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft

2010-05-19 23:05:16 ----D---- C:\Program Files\Vilma

2010-05-19 22:38:16 ----A---- C:\WINDOWS\lsrslt.ini

2010-05-19 21:50:57 ----A---- C:\WINDOWS\ntbtlog.txt

2010-05-19 21:22:46 ----D---- C:\Documents and Settings\Fanou\Application Data\ATManager

2010-05-13 11:10:06 ----A---- C:\WINDOWS\cdplayer.ini

2010-05-12 08:31:06 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$

2010-04-25 20:55:42 ----D---- C:\Program Files\MSECache

 

======List of files/folders modified in the last 1 months======

 

2010-05-23 20:34:02 ----D---- C:\WINDOWS\system32\drivers

2010-05-23 20:33:33 ----D---- C:\WINDOWS\Prefetch

2010-05-23 20:27:59 ----D---- C:\WINDOWS\Internet Logs

2010-05-23 20:21:51 ----D---- C:\WINDOWS\Temp

2010-05-23 19:52:03 ----D---- C:\WINDOWS\system32

2010-05-23 19:16:43 ----SHD---- C:\System Volume Information

2010-05-23 19:16:43 ----D---- C:\WINDOWS\system32\Restore

2010-05-23 18:26:00 ----A---- C:\WINDOWS\SchedLgU.Txt

2010-05-23 18:07:00 ----SD---- C:\WINDOWS\Tasks

2010-05-23 18:06:16 ----D---- C:\WINDOWS\system32\CatRoot2

2010-05-23 17:42:32 ----RD---- C:\Program Files

2010-05-23 15:26:20 ----HD---- C:\Config.Msi

2010-05-22 19:11:25 ----A---- C:\WINDOWS\NeroDigital.ini

2010-05-22 18:36:52 ----SHD---- C:\WINDOWS\Installer

2010-05-22 18:36:50 ----D---- C:\Program Files\Lavasoft

2010-05-22 18:31:42 ----AD---- C:\WINDOWS

2010-05-22 17:57:48 ----D---- C:\WINDOWS\system32\NtmsData

2010-05-22 15:33:50 ----D---- C:\WINDOWS\SxsCaPendDel

2010-05-22 15:13:43 ----D---- C:\Documents and Settings\All Users\Application Data\NOS

2010-05-22 14:51:54 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer

2010-05-22 14:50:54 ----D---- C:\Program Files\Fichiers communs

2010-05-21 17:25:29 ----D---- C:\Documents and Settings\Fanou\Application Data\Spyware Terminator

2010-05-21 17:18:07 ----HD---- C:\Program Files\InstallShield Installation Information

2010-05-21 17:18:06 ----D---- C:\Program Files\Fichiers communs\PC Tools

2010-05-21 17:04:39 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2010-05-21 16:55:12 ----HD---- C:\WINDOWS\inf

2010-05-21 16:53:55 ----D---- C:\Program Files\PCMEdit

2010-05-21 16:52:11 ----D---- C:\Program Files\Google

2010-05-21 16:42:48 ----D---- C:\WINDOWS\WinSxS

2010-05-21 16:37:09 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP

2010-05-21 16:24:25 ----RASH---- C:\boot.ini

2010-05-21 16:24:25 ----A---- C:\WINDOWS\win.ini

2010-05-21 16:24:25 ----A---- C:\WINDOWS\system.ini

2010-05-21 12:17:06 ----D---- C:\Program Files\Spyware Terminator

2010-05-21 12:15:30 ----D---- C:\Documents and Settings\All Users\Application Data\Spyware Terminator

2010-05-21 11:38:35 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2010-05-21 07:51:37 ----D---- C:\Documents and Settings\All Users\Application Data\Hitman Pro

2010-05-20 14:18:56 ----D---- C:\Documents and Settings

2010-05-20 14:02:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$

2010-05-20 08:02:55 ----D---- C:\WINDOWS\PeerNet

2010-05-20 08:00:44 ----D---- C:\WINDOWS\system32\wbem

2010-05-19 23:03:54 ----RSHD---- C:\WINDOWS\system32\dllcache

2010-05-19 22:48:50 ----D---- C:\Malwarebytes' Anti-Malware

2010-05-19 22:45:15 ----D---- C:\WINDOWS\pss

2010-05-14 08:42:23 ----D---- C:\WINDOWS\Registration

2010-05-13 10:47:34 ----N---- C:\WINDOWS\system32\pxinsa64.exe

2010-05-13 10:47:34 ----N---- C:\WINDOWS\system32\pxhpinst.exe

2010-05-13 10:47:34 ----N---- C:\WINDOWS\system32\pxcpya64.exe

2010-05-13 10:47:30 ----N---- C:\WINDOWS\system32\PxSFS.DLL

2010-05-13 10:47:30 ----N---- C:\WINDOWS\system32\Px.dll

2010-05-13 10:47:29 ----N---- C:\WINDOWS\system32\PxWave.dll

2010-05-13 10:47:29 ----N---- C:\WINDOWS\system32\pxdrv.dll

2010-05-13 10:47:28 ----N---- C:\WINDOWS\system32\PxMas.dll

2010-05-12 08:31:09 ----D---- C:\Program Files\Outlook Express

2010-05-12 08:27:13 ----HD---- C:\WINDOWS\$hf_mig$

2010-05-04 08:49:41 ----D---- C:\Program Files\Power IE

2010-04-30 20:51:06 ----A---- C:\WINDOWS\system32\MRT.exe

2010-04-25 20:57:15 ----SD---- C:\Documents and Settings\Fanou\Application Data\Microsoft

2010-04-25 20:56:28 ----RSD---- C:\WINDOWS\Fonts

2010-04-25 20:56:17 ----D---- C:\Program Files\Microsoft Office

2010-04-25 20:56:14 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared

 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2006-04-02 82380]

R1 AmdK8;Pilote de processeur AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 43008]

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]

R1 eabfiltr;EABFiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys []

R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2004-09-07 28672]

R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2004-09-07 27648]

R1 KLIF;KLIF; C:\WINDOWS\system32\DRIVERS\klif.sys [2007-07-19 127768]

R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2010-04-20 28520]

R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2008-07-09 394952]

R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]

R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-04-20 56816]

R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]

R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]

R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-09-28 1345536]

R3 BCM43XX;Pilote pour carte réseau Broadcom 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2009-10-12 1952512]

R3 BTDriver;Pilote de communications virtuelles Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-02-04 37160]

R3 BTKRNL;Enumérateur de bus Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-04-15 990632]

R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-03-27 47272]

R3 CAMCAUD;Conexant AMC Audio; C:\WINDOWS\system32\drivers\camc6aud.sys [2005-08-02 38016]

R3 CAMCHALA;CAMCHALA; C:\WINDOWS\system32\drivers\camc6hal.sys [2005-08-02 349312]

R3 CmBatt;Pilote d'adaptateur secteur Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]

R3 GEARAspiWDM;GEAR CDRom Filter; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2004-09-14 13872]

R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2005-08-22 1035008]

R3 HSFHWATI;HSFHWATI; C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-08-22 231424]

R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]

R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-06-21 74496]

R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]

R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2005-06-19 190400]

R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-06-22 162176]

R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]

R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]

R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]

R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-08-22 718464]

R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2004-09-07 92928]

S3 btaudio;Périphérique audio Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2008-04-15 534440]

S3 BTWDNDIS;Serveur d'accès au réseau local Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2007-09-20 156392]

S3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2008-03-10 57384]

S3 eabusb;eabusb; \??\C:\WINDOWS\system32\drivers\eabusb.sys []

S3 hitmanpro3;Hitman Pro 3 Support Driver; \??\C:\WINDOWS\system32\drivers\hitmanpro3.sys []

S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-03-09 51024]

S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-03-09 16080]

S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-03-09 21456]

S3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]

S3 SMCIRDA;Pilote de périphérique SMC IrCC Miniport; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-08-23 36937]

S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]

S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]

S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

S3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]

S3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver; C:\WINDOWS\system32\DRIVERS\WlanUIG.sys []

S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

S4 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]

 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-04-20 108289]

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-04-20 185089]

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-09-28 376832]

R2 btwdins;Bluetooth Service; C:\Program Files\ASUS\Bluetooth Software\bin\btwdins.exe [2008-04-14 342624]

R2 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2004-09-07 1192048]

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-25 153376]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [2005-09-22 53248]

R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]

R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE [2007-08-09 73728]

R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2008-11-09 537600]

R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2008-07-09 75304]

R3 hpqwmi;HP WMI Interface; C:\Program Files\HPQ\SHARED\HPQWMI.exe [2005-10-11 102400]

S2 gupdate1c9a8b8bcc51050;Service Google Update (gupdate1c9a8b8bcc51050); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-03-19 133104]

S2 InCDsrvR;InCD Helper (read only); C:\Program Files\Ahead\InCD\InCDsrv.exe [2004-09-07 1192048]

S2 qygtmniu;Print Class for IEEE-1284.4 HPZipr12Helper; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]

S2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-25 138168]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 iPodService;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2004-10-13 327680]

S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]

S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

 

-----------------EOF-----------------

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Suis le conseil d'Antivir: supprime-le.

 

ComboFix ne doit pas être utilisé comme un outil de diagnostic, il ne doit être employé que sur demande expresse d'un conseiller formé à cet outil et sous son contrôle. Cet outil peut être dangereux!

 

img-0957469x7jp.gif Désactiver les protections (antivirus, firewall, antispyware).

 

Connecter les supports amovibles (clé usb et autres) avant de procéder.

 

TUTO Officiel

 

Fais un clic droit ICI

  • Dans le menu qui se déroule, choisis "Enregistrer la cible du lien sous" (si tu utilises Firefox) et "Enregistrer la cible sous" (si tu utilises Internet Explorer)
  • Une fenêtre va s'ouvrir: dans le champs Nom du fichier (en bas ), tape ceci img-0957469x7jp.gif panpan.
  • On va enregistrer ce fichier sur le Bureau: pour cela, sur le panneau de gauche, clique sur le Bureau.
     
  • Clique enfin sur le bouton Enregistrer en bas de page à droite.
  • Assure toi que tous les programmes sont fermés avant de lancer le fix!
  • Fait un double clique sur panpan.
  • Si la console de récupération n'est pas installée sur un XP, ComboFix va proposer de l'installer: Accepte!
  • Clique sur Oui au message de Limitation de Garantie qui s'affiche.
  • Il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sure: accepte!
  • Note: Ne ferme pas la fenêtre qui vient de s'ouvrir , tu te retrouverais avec un bureau vide !
  • Lorsque le scan est terminé, un rapport sera généré : poste en le contenu dans ton prochain message.

 

Si tu perds la connexion après le passage de ComboFix, voici comment la réparer ICI.

 

NB: Si malgré tout, tu ne parviens pas à réparer la connexion, lis ce sujet stp.

 

Si le message: "Tentative d'opération non autorisée sur une clé du Registre marquée pour suppression".

apparaissait, redémarrer le pc.

 

sshot-1-9.jpg

 

+++

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

A propos, si tu as déjà lancé CF une fois, donne-moi d'abord le rapport combofix.txt qui est sur le c.

 

Ensuite, télécharge une nouvelle copie avant de la lancer et si AVG n'est plus là, passe outre l'avertissement.

 

@++

Guenillot Junior Member

Guenillot

Posté(e)
  • Auteur
Posté(e)

Je crois qu'il a trouvé qqchose...

 

ComboFix 10-05-23.01 - Fanou 23/05/2010 21:22:37.1.1 - x86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1022.606 [GMT 2:00]

Lancé depuis: c:\documents and settings\Fanou\Bureau\panpan.exe

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

ADS - WINDOWS: deleted 24 bytes in 1 streams.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\Fanou\Application Data\ATManager

c:\documents and settings\Fanou\Application Data\Microsoft\HTML Help\hh.dat

c:\windows\system32\drivers\etc\lmhosts . . . . impossible à supprimer

c:\windows\system32\udjsklr.dll . . . . impossible à supprimer

 

Une copie infectée de c:\windows\system32\drivers\isapnp.sys a été trouvée et désinfectée

Copie restaurée à partir de - Kitty had a snack :P

c:\windows\system32\grpconv.exe était absent

Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\grpconv.exe

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_QYGTMNIU

-------\Legacy_SSHNAS

-------\Service_qygtmniu

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2010-04-23 au 2010-05-23 ))))))))))))))))))))))))))))))))))))

.

 

2010-05-23 19:35 . 2008-04-14 02:34 39424 ----a-w- c:\windows\system32\grpconv.exe

2010-05-23 19:35 . 2008-04-14 02:34 39424 ----a-w- c:\windows\system32\dllcache\grpconv.exe

2010-05-23 15:19 . 2010-05-23 15:43 -------- d-----w- C:\Ad-Remover

2010-05-22 20:52 . 2010-05-23 05:51 -------- d-----w- c:\documents and settings\Fanou\Application Data\QuickScan

2010-05-22 14:06 . 2010-05-22 14:06 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-05-22 13:31 . 2010-05-22 13:31 -------- d-----w- C:\found.000

2010-05-22 12:51 . 2010-05-22 12:52 -------- d-----w- c:\program files\QuickTime

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\program files\Fichiers communs\Apple

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\documents and settings\Fanou\Local Settings\Application Data\Apple

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\program files\Apple Software Update

2010-05-22 12:50 . 2010-05-22 12:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2010-05-22 12:47 . 2010-05-22 12:47 -------- d-----w- c:\documents and settings\Fanou\Application Data\DivX

2010-05-22 12:45 . 2010-05-22 12:45 -------- d-----w- c:\program files\Fichiers communs\DivX Shared

2010-05-22 12:43 . 2010-05-22 12:47 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX

2010-05-22 07:58 . 2010-05-22 07:58 -------- d-----r- c:\documents and settings\NetworkService\Favoris

2010-05-21 21:03 . 2010-05-21 21:03 -------- d-----w- c:\documents and settings\Fanou\DoctorWeb

2010-05-21 11:10 . 2010-05-21 11:10 -------- d-----w- c:\documents and settings\Administrateur\DoctorWeb

2010-05-21 11:09 . 2010-05-21 11:09 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE

2010-05-21 10:38 . 2010-05-21 10:38 -------- d-----r- c:\documents and settings\LocalService\Favoris

2010-05-21 10:22 . 2010-05-23 05:48 -------- d-----w- C:\tdsskiller

2010-05-21 07:23 . 2010-05-21 07:23 -------- d-----w- c:\documents and settings\NetworkService\Bureau

2010-05-21 06:54 . 2010-05-21 06:54 -------- d-----w- c:\documents and settings\Fanou\Local Settings\Application Data\Sunbelt Software

2010-05-21 06:53 . 2010-05-22 16:36 -------- dc----w- c:\windows\system32\DRVSTORE

2010-05-21 06:53 . 2010-05-21 06:53 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-05-21 06:38 . 2010-05-22 16:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2010-05-20 21:09 . 2010-05-20 21:10 -------- d-----w- c:\documents and settings\LocalService\Bureau

2010-05-20 15:44 . 2010-05-20 15:44 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Spyware Terminator

2010-05-20 12:20 . 2010-05-20 12:20 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Malwarebytes

2010-05-20 12:20 . 2010-05-20 12:20 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache

2010-05-20 12:19 . 2005-11-30 00:28 135 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat

2010-05-20 12:19 . 2005-11-30 00:53 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Apple Computer

2010-05-19 21:05 . 2010-05-21 15:02 -------- d-----w- c:\program files\Vilma

2010-04-25 18:55 . 2010-04-25 18:55 -------- d-----w- c:\program files\MSECache

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-23 19:43 . 2008-11-09 19:12 175931424 --sha-w- c:\windows\system32\drivers\fidbox.dat

2010-05-23 19:37 . 2008-11-09 19:12 2065784 --sha-w- c:\windows\system32\drivers\fidbox.idx

2010-05-22 16:36 . 2008-11-08 19:18 -------- d-----w- c:\program files\Lavasoft

2010-05-22 13:13 . 2008-07-08 09:49 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-05-22 12:51 . 2005-11-30 00:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-05-22 12:49 . 2010-05-22 12:49 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-05-22 12:47 . 2010-05-22 12:47 56766 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-05-22 12:47 . 2010-05-22 12:47 56978 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe

2010-05-22 12:47 . 2010-05-22 12:47 53600 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe

2010-05-22 12:47 . 2010-05-22 12:47 57679 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 84040 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 57054 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54166 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 57532 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 56458 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54174 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54153 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54128 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54629 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe

2010-05-22 12:46 . 2010-05-22 12:46 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe

2010-05-22 12:45 . 2010-05-22 12:45 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe

2010-05-22 12:45 . 2010-05-22 12:45 56969 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe

2010-05-22 12:44 . 2010-05-22 12:44 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe

2010-05-22 12:43 . 2010-05-22 12:47 754984 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll

2010-05-22 12:41 . 2010-05-22 12:47 1180952 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe

2010-05-21 15:25 . 2008-11-09 18:25 -------- d-----w- c:\documents and settings\Fanou\Application Data\Spyware Terminator

2010-05-21 15:18 . 2005-11-30 00:29 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-05-21 15:18 . 2010-03-18 19:25 -------- d-----w- c:\program files\Fichiers communs\PC Tools

2010-05-21 15:04 . 2008-11-08 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-05-21 14:53 . 2008-07-28 13:51 -------- d-----w- c:\program files\PCMEdit

2010-05-21 14:52 . 2005-11-30 01:00 -------- d-----w- c:\program files\Google

2010-05-21 14:37 . 2008-11-08 19:21 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-05-21 10:17 . 2008-11-09 18:25 -------- d-----w- c:\program files\Spyware Terminator

2010-05-21 10:15 . 2008-11-09 18:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator

2010-05-21 09:38 . 2004-08-17 09:31 514770 ----a-w- c:\windows\system32\perfh00C.dat

2010-05-21 09:38 . 2004-08-17 09:31 86428 ----a-w- c:\windows\system32\perfc00C.dat

2010-05-21 05:51 . 2008-11-08 19:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro

2010-05-20 11:48 . 2010-03-18 15:40 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2010-05-20 06:03 . 2009-02-18 09:43 13864843 ----a-w- c:\windows\Internet Logs\tvDebug.zip

2010-05-18 15:21 . 2010-05-22 20:52 702120 ----a-w- c:\documents and settings\Fanou\Application Data\Mozilla\Firefox\Profiles\bgmw1mf2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

2010-05-18 15:21 . 2010-05-22 20:52 868456 ----a-w- c:\documents and settings\Fanou\Application Data\Mozilla\Firefox\Profiles\bgmw1mf2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

2010-05-13 08:47 . 2005-04-25 01:03 45200 ----a-w- c:\windows\system32\drivers\pxhelp20.sys

2010-05-04 06:49 . 2010-03-05 07:25 3774 ----a-r- c:\documents and settings\Fanou\Application Data\Microsoft\Installer\{AF7C627C-F354-4FF1-8450-398C806B436E}\_4bde371b.exe

2010-05-04 06:49 . 2010-03-05 07:25 29926 ----a-r- c:\documents and settings\Fanou\Application Data\Microsoft\Installer\{AF7C627C-F354-4FF1-8450-398C806B436E}\_3d366f1d.exe

2010-05-04 06:49 . 2008-11-11 09:59 -------- d-----w- c:\program files\Power IE

2010-04-29 13:39 . 2008-11-10 20:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 13:39 . 2008-11-10 20:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-26 05:50 . 2006-03-12 18:17 126632 ----a-w- c:\documents and settings\Fanou\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-04-20 15:45 . 2010-03-18 19:37 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2010-04-16 19:04 . 2010-04-16 18:55 -------- d-----w- c:\documents and settings\Fanou\Application Data\freeTVRadio

2010-04-16 18:19 . 2010-04-16 18:19 -------- d-----w- c:\program files\Avira

2010-04-16 18:19 . 2010-04-16 18:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2010-04-16 08:39 . 2006-03-23 21:43 -------- d-----w- c:\program files\Fichiers communs\Adobe

2010-04-15 13:26 . 2010-05-20 06:31 1286521 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescript.dll

2010-04-15 13:26 . 2010-05-20 06:31 541043 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aerdl.dll

2010-04-15 13:26 . 2010-05-20 06:31 2613623 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeheur.dll

2010-04-15 13:26 . 2010-05-20 06:31 373106 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aegen.dll

2010-04-13 06:56 . 2010-04-11 16:06 -------- d-----w- c:\documents and settings\Fanou\Application Data\Stellarium

2010-04-11 15:54 . 2010-04-11 15:54 -------- d-----w- c:\program files\Stellarium

2010-04-10 14:50 . 2010-04-10 15:37 2772992 ----a-w- c:\windows\Internet Logs\xDB9.tmp

2010-04-09 19:00 . 2008-07-04 13:21 -------- d-----w- c:\program files\AVG

2010-04-09 08:11 . 2010-04-02 10:29 -------- d-----w- c:\program files\Citemaison

2010-04-05 08:40 . 2010-04-05 08:41 2741760 ----a-w- c:\windows\Internet Logs\xDB8.tmp

2010-04-01 15:06 . 2010-05-20 06:31 242039 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aehelp.dll

2010-04-01 15:06 . 2010-05-20 06:31 188790 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aecore.dll

2010-03-31 01:58 . 2010-01-15 21:04 133616 ------w- c:\windows\system32\pxafs.dll

2010-03-31 01:58 . 2006-03-26 22:07 125424 ------w- c:\windows\system32\pxinsi64.exe

2010-03-31 01:58 . 2006-03-26 22:07 123888 ------w- c:\windows\system32\pxcpyi64.exe

2010-03-19 10:36 . 2010-05-20 06:31 426358 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aepack.dll

2010-03-17 09:11 . 2010-05-20 06:31 254323 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aesbx.dll

2010-03-17 09:11 . 2010-05-20 06:31 201083 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aeoffice.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll

2010-03-12 07:43 . 2010-03-12 07:43 300616 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll

2010-03-12 07:43 . 2010-03-12 07:43 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll

2010-03-12 07:43 . 2010-03-12 07:43 329312 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

2010-03-12 07:39 . 2003-03-19 02:14 499712 ----a-w- c:\windows\system32\msvcp71.dll

2010-03-10 06:16 . 2004-08-05 08:00 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-03-08 17:59 . 2010-03-08 17:59 94208 ----a-w- c:\windows\system32\dpl100.dll

2010-02-25 16:40 . 2010-05-20 06:31 127347 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\FAILSAVE\aescn.dll

2010-02-25 06:17 . 2004-08-05 08:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-02-24 13:11 . 2004-08-05 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-24 08:16 . 2009-10-03 12:11 181632 ------w- c:\windows\system32\MpSigStub.exe

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-18 68856]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-19 729178]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]

"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 221184]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-10-11 409600]

"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-08-01 233534]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-09-27 344064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2010-03-12 202256]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

 

c:\documents and settings\Default User\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

 

c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

 

c:\documents and settings\Default User\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

 

c:\documents and settings\Default User\Menu D‚marrer\Programmes\D‚marrage\

AutoTBar.exe [2003-9-30 57344]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk

backup=c:\windows\pss\BTTray.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hp psc 1000 series.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\hp psc 1000 series.lnk

backup=c:\windows\pss\hp psc 1000 series.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk

backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk

backup=c:\windows\pss\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^Fanou^Menu Démarrer^Programmes^Démarrage^Antimalware Doctor.lnk]

path=c:\documents and settings\Fanou\Menu Démarrer\Programmes\Démarrage\Antimalware Doctor.lnk

backup=c:\windows\pss\Antimalware Doctor.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]

2005-05-04 09:59 794624 ----a-w- c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

2004-09-07 12:39 1450094 ------w- c:\program files\Ahead\InCD\InCD.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2004-10-13 15:04 278528 ----a-w- c:\program files\iTunes\iTunesHelper.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]

2004-10-14 12:54 253952 ----a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]

2008-11-09 18:25 2158592 ----a-w- c:\progra~1\SPYWAR~2\SpywareTerminatorShield.Exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-03-12 07:39 202256 ----a-w- c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=

"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=

"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=

 

R0 zupbryql;zupbryql;c:\windows\system32\drivers\zupbryql.sys --> c:\windows\system32\drivers\zupbryql.sys [?]

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [16/04/2010 20:20 108289]

R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [22/08/2005 11:06 231424]

S2 gupdate1c9a8b8bcc51050;Service Google Update (gupdate1c9a8b8bcc51050);c:\program files\Google\Update\GoogleUpdate.exe [19/03/2009 19:32 133104]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 20:19 13592]

S3 hitmanpro3;Hitman Pro 3 Support Driver;\??\c:\windows\system32\drivers\hitmanpro3.sys --> c:\windows\system32\drivers\hitmanpro3.sys [?]

S3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;c:\windows\system32\DRIVERS\WlanUIG.sys --> c:\windows\system32\DRIVERS\WlanUIG.sys [?]

.

Contenu du dossier 'Tâches planifiées'

 

2010-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

 

2006-10-21 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8143979466.job

- c:\program files\HP\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

 

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 17:31]

 

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-19 17:31]

 

2010-05-23 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2826103261-839955967-4107118250-1006.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

 

2010-05-23 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2826103261-839955967-4107118250-1006.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 21:09]

 

2010-05-23 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-11-30 14:59]

 

2010-05-23 c:\windows\Tasks\User_Feed_Synchronization-{D3C75F43-DEEB-45DD-9930-304B2E5B4289}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

.

.

------- Examen supplémentaire -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = hxxp://192.168.1.1/ServicesAcces.html

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Envoyer au périphérique &Bluetooth... - c:\program files\ASUS\Bluetooth Software\btsendto_ie_ctx.htm

IE: Envoyer à &Bluetooth - c:\program files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm

IE: Envoyer à Bluetooth - c:\program files\ASUS\Bluetooth Software\btsendto_ie.htm

Trusted Zone: localhost

DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_9418.cab

FF - ProfilePath - c:\documents and settings\Fanou\Application Data\Mozilla\Firefox\Profiles\bgmw1mf2.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.orange.fr/

 

---- PARAMETRES FIREFOX ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.

- - - - ORPHELINS SUPPRIMES - - - -

 

BHO-{E68E2B73-8EA0-4A94-A901-EB2C55A23932} - c:\windows\system32\udjsklr.dll

ShellIconOverlayIdentifiers-{E68E2B73-8EA0-4A94-A901-EB2C55A23932} - c:\windows\system32\udjsklr.dll

HKLM-Run-DivXUpdate - c:\program files\DivX\DivX Update\DivXUpdate.exe

Notify-avgrsstarter - avgrsstx.dll

MSConfigStartUp-gotnewupdate000 - c:\documents and settings\Fanou\Application Data\110A0F8412C1B9A25D0DEEF69C4385FD\gotnewupdate000.exe

MSConfigStartUp-hdqgyykv - c:\documents and settings\Fanou\Local Settings\Application Data\gbflwonim\iiycwjgtssd.exe

MSConfigStartUp-hsfe8owijfisjhgs7ye39gjsoighsd7y3eu - c:\docume~1\Fanou\LOCALS~1\Temp\i1llwh9.exe

MSConfigStartUp-hsfg9w8gujsokgahi8gysgnsdgefshyjy - c:\docume~1\Fanou\LOCALS~1\Temp\lsass.exe

MSConfigStartUp-M5T8QL3YW3 - c:\docume~1\Fanou\LOCALS~1\Temp\Jvd.exe

MSConfigStartUp-mcexecwin - c:\docume~1\Fanou\LOCALS~1\Temp\owwztd.dll

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-23 21:39

Windows 5.1.2600 Service Pack 3 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????5?5?9?6??????? ???B?????????????hLC? ??????

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_USERS\S-1-5-21-2826103261-839955967-4107118250-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:fc,70,f7,6d,8a,45,7a,f8,d1,e1,93,33,9a,c2,31,95,8c,b1,33,5a,7e,b1,92,

39,8d,b9,c3,ac,74,cf,e7,e0,8f,5d,03,5f,57,95,2a,64,db,55,a2,b4,1d,44,71,c7,\

"??"=hex:46,ff,bb,81,33,3d,2c,e7,0f,bd,b1,88,db,8a,f9,e5

 

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'winlogon.exe'(736)

c:\windows\system32\Ati2evxx.dll

 

- - - - - - - > 'explorer.exe'(1096)

c:\program files\Windows Media Player\wmpband.dll

c:\windows\system32\eappprxy.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\btncopy.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Ahead\InCD\InCDsrv.exe

c:\program files\ASUS\Bluetooth Software\bin\btwdins.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Fichiers communs\LightScribe\LSSrvc.exe

c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

c:\program files\Spyware Terminator\sp_rsser.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\program files\HPQ\SHARED\HPQWMI.exe

c:\program files\Java\jre6\bin\jucheck.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Heure de fin: 2010-05-23 21:48:38 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-05-23 19:48

 

Avant-CF: 18 943 983 616 octets libres

Après-CF: 20 221 579 264 octets libres

 

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

 

- - End Of File - - 18104CFB187E2CDBD5982D5D3F4FF4A4

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Re,

 

Deux étapes:

 

Télécharge RHosts (de S!RI) sur ton Bureau. http://siri.urz.free.fr/Softs/RHosts.exe

 

Ferme les applications en cours.

 

Double-clique sur RHosts.exe pour lancer l'outil.

Clique sur le bouton Restaurer. Confirme simplement.

Ferme l'outil.

 

----------------------------------------------------

 

Ce script a été rédigé spécialement pour cet utilisateur; ne pas l'utiliser sur une autre machine: dangereux!

 

1. Ferme tous les navigateurs ouverts.

2. Désactive provisoirement l'antivirus.

 

--> connecte les supports amovibles!

 

2. Ferme/désactive tous les programmes anti-virus, anti-malware ou anti-spyware afin qu'ils n'interfèrent pas avec le travail de ComboFix.

 

3. Ouvre le Bloc-notes et fais un copier/coller du texte situé dans la boîte Code ci-dessous dans le Bloc-notes: (sans le mot code)!

 

http://forum.zebulon.fr/index.php?s=&showtopic=176891&view=findpost&p=1489583

Collect::

KillAll::

File::

c:\windows\system32\udjsklr.dll 

Registry::

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E68E2B73-8EA0-4A94-A901-EB2C55A23932}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E68E2B73-8EA0-4A94-A901-EB2C55A23932}]

 

Enregistre le fichier sous le nom CFScript.txt, au même endroit que ComboFix.exe

 

 

img-195530n0pz2.gif

 

Comme sur l'image ci-dessus, fais glisser CFScript puis dépose-le sur ComboFix.exe

 

Lorsque l'outil aura terminé, il t'affichera un rapport nommé C:\ComboFix.txt que tu devras m'envoyer dans ton prochain message.

 

@++

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Poursuis avec le CFScript de ComboFix; il a sans doute réinitialialisé le Hosts.

 

On va bien voir.

 

++

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...